Illinois judge refuses to dismiss Shutterfly face recognition privacy suit

An Illinois federal judge refused to dismiss a putative class action against Shutterfly Inc. which alleges the company violated the state’s Biometric Information Privacy Act by obtaining and retaining face geometry scans of citizens without their consent, according to a report by Law360.

The judge ruled that the statute covers data taken from photos and does not require consumers to specify actual damages.

U.S. District Judge Joan B. Gottschall issued a 19-page ruling in response to Shutterfly’s February motion to dismiss the lawsuit.

According to the suit, lead plaintiff Alejandro Monroy said that Shutterfly used a photo that his friend uploaded to the website to create and store a template of Monroy’s face without his consent.

Shutterfly’s motion alleged that Monroy, a Florida resident who has never used Shutterfly, should not be allowed to move forward with his suit because BIPA does not apply to scans of face geometry taken from photographs; that the statute requires Monroy to specify the actual damages he incurred; and that Monroy’s claims required an impermissible extraterritorial application of the statute.

Judge Gottschall emphatically rejected all of three of Shutterfly’s arguments.

Shutterfly argued that BIPA does not apply to photographs due to the statute’s use of the terms “biometric identifier” and “biometric information,” which explicitly excludes information taken from sources such as writing samples, signatures, photographs and tattoos.

The online photo publisher argued that by excluding data taken from photos, the Illinois General Assembly clearly intended to place outside of BIPA’s range of all biometric data obtained from photos

“This reading of the statute seems sensible enough at first blush, but it begins to unravel under scrutiny,” Judge Gottschall wrote, referencing previous rulings in BIPA cases against Google in Illinois and Facebook in California, which rejected the stance that the statute does not apply to all information taken from photos.

Judge Gottschall wrote that if biometric identifiers did not include this data, as Shutterfly advocates for, the statute would only cover in-person scans of a person’s face — a reading she called “problematic in many respects.”

“The Illinois General Assembly clearly sought to define the term ‘biometric identifier’ with a great deal of specificity,” the judge wrote in his ruling. “If the legislature had intended a ‘scan of face geometry’ to refer only to scans taken of an individual’s actual face, it is reasonable to think that it would have signaled this more explicitly.”

He added that the so-called narrow reading of the statute would also “leave little room for the law to adapt and respond to technological development,” and that it was unlikely that legislators intended to limit the definition of biometric information to only in-person uses considering that the full impact of biometric technology is still unknown.

In regards to Shutterfly’s argument that BIPA requires the specification of actual injury, Judge Gottschall ruled that while the question was “a close one,” she was not completely convinced by Shutterfly’s position.

Although BIPA does not explicitly define the meaning of actual damages, the statute does allow plaintiffs to recover “liquidated damages of $1,000 or actual damages, whichever is greater.” This differentiates it from previous court decisions that ruled that other statutes such as the Privacy Act and Video Privacy Protection Act require plaintiffs to specify actual damages.

“In short, while the matter is not free from doubt, the court declines to hold that a showing of actual damages is necessary in order to state a claim under BIPA,” the judge ruled.

Finally, Judge Gottschall disagreed with Shutterfly’s stance that the suit requires the court to apply BIPA extraterritorially or in a manner that violates the U.S. Constitution’s dormant commerce clause.

Determining the actual location of the scan of Monroy’s face geometry and the storage of said information requires “a fuller understanding of how Shutterfly’s facial recognition technology operates.”

As such, Judge Gottschall wrote in his ruling that at this stage she was “not persuaded by Shutterfly’s extraterritoriality argument,” but did admit that the argument could be revisited “if and when the record affords a clearer picture of the circumstances relating to Monroy’s claim.”

A separate lawsuit against Shutterfly which alleged the company’s facial recognition software violated a plaintiff’s privacy, was settled in April 2016.

Article Topics

Biometric Information Privacy Act (BIPA)  |  biometrics  |  facial recognition  |  legislation  |  privacy  |  Shutterfly